Those DDOS attacks were performed using a botnet. A botnet is a network of consumer PCs infected with malware. Such botnets are routinely used for a lot of activities, most of them illegal or at least ethically questionable. For that reason the people who control a botnet do their best not to get found. They usually control their botnets using obscure methods of anonymous communication which are very hard to track back to them.
You might wonder "considering the publications lately about the internet spying capabilities of the US government, how couldn't they get found?". Maybe the US government is aware who did it, and when they aren't they could easily find out. But the truth is that even though the US government collects bulk data about everyone in the world, the current legal situation does not allow them to prosecute anyone based on that data. All that data collection is illegal wiretapping, so it may not be used as evidence in court.
The only thing the US government can do against people they only have evidence against through their surveillance programs are
illegal extrajudical actions like kidnapping them and deporting them to a secret prison or killing them through a drone strike. Such drastic actions are currently only performed against people who are deemed a danger to national security (or live near the Afghan/Pakistan border).
And contrary to what some "Hacktivists" believe, making a public website of a government agency unreachable for a few hours, is not an attack on national security. Such an attack is about on the same danger-level as drawing an defamatory graffiti on their wall.